MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a98d855dc11a51891bc064ce016cd7849072104cac57171a81eefd21f3d19968. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Rhadamanthys

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	a98d855dc11a51891bc064ce016cd7849072104cac57171a81eefd21f3d19968
SHA3-384 hash:	60e4160231c4774b95c185f609b26ceae1ba69e4071a2ac10e50f7abf1c28b8d9da08e7a3ede668b3d8f893288656d4b
SHA1 hash:	a2996d0a2f8c5dce4350157383f712a94a29fd91
MD5 hash:	07f55779ae76d5c408817483d28f23ce
humanhash:	zulu-freddie-fix-hydrogen
File name:	Free Download Files.zip
Download:	download sample
Signature	Rhadamanthys Create hunting rule
File size:	27'050'790 bytes
First seen:	2025-05-31 17:21:40 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	786432:aJ1tnCVGXP0rXhQOsYseq7Po5KUSEN7Hlb0SVSjH:+lYXQ7Y6k4+6SV2
TLSH	T1E357237AB51C98A0FB1745F19179664C80DAD8E021B37DFA3B04A5094E9FAE0973B34F
TrID	46.6% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3) 35.5% (.XPI) Mozilla Firefox browser extension (8000/1/1) 17.7% (.ZIP) ZIP compressed archive (4000/1)
Magika	zip
Reporter	aachum
Tags:	178-20-45-155 5-35-38-7 api-gameforlikaks-top RenPy RenPyLoader Rhadamanthys zip

iamaachum

https://www.mediafire.com/file/raakkxyoiv9dn1f/Free+Download+Files.zip/file

Intelligence

File Origin

# of uploads :

# of downloads :

103

Origin country :

Vendor Threat Intelligence

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=683b3d89668438e362e90530

Tags:

n/a

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

anti-debug packed packed packer_detected

Link:

https://www.filescan.io/uploads/683b3b0ae336a33801e12169/reports/e4990456-74bc-423c-a500-72d3c27bf544/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/a98d855dc11a51891bc064ce016cd7849072104cac57171a81eefd21f3d19968

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/a98d855dc11a51891bc064ce016cd7849072104cac57171a81eefd21f3d19968

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Score:

67%

Verdict:

Susipicious

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	adonunix2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	AD on UNIX

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)